Hi , It was mentioned earlier by Stephen Sorkin [Splunk] ♦ in one of his answers. I am just coping this remark on the same. i find it really useful In general, we recommend search-time extractions rather than index-time extractions. There are relatively few cases where index-time extractions are better, and they come at the cost of brittleness of configuration and an increase in index size (which in turn makes searches slower). The distinction in the UI of "uses transform" vs. inline doesn't have anything to do with search-time vs index-time. It is referring to where the regex itself is stored: in an EXTRACT- line in props.conf (for inline) as opposed to in a REPORT- line that refers to a stanza in transforms.conf (for uses transform). Index time extractions are also set in props.conf and transforms.conf by means of the TRANSFORM- line. Again, they should rarely be used. They are appropriate when the heuristic of search for the value of the field fails (either because the value is ubiquitous outside of cases where the field equals the value, or because the value isn't an indexed token) or when you commonly search for field!=value without other terms to constrain the search. Link of the answer : https://answers.splunk.com/answers/5817/search-time-versus-index-time-field-extractions.html ... View more

@back2root i have some other questions which i have tried to answer, hope you can tell me if i am on right path. 1)Make a search that sums read_ops and write_ops(Disk io) Ans: index="main" host="linux" read_ops="" write_ops="" |eval sum=read_ops+write_ops 2)Make a search that finds the heighest disk io for a time period Ans: index="main" host="linux" write_ops="*" |stats max(count) by write_ops 3)Make search that finds the wait_time over 10 Ans: index="main" host="linux" wait_time="*" wait_time>10 4)Make a search that finds write_kB/write_ops and gives the overall average for the entire search time Ans: index="main" host="linux" write_KB="" write_ops="" |eval result = write_kB/write_ops //calculates |stats avg(result) //finds the average |timechart count by result // for the entire search time ... View more

Thank you very much! ... View more